Amendments to the Claims 

This listing of claims will replace all prior versions, and listings of claims, in the 
application: 

1 . (currently amended) A computer implemented method for gleaning file attributes 
independently of file format, the method comprising the steps of: 

a non-application specific file attribute manager receiving a plurality of files in a 
plurality of formats; 

the file attribute manager scanning the plurality of received files in the plurality of 
formats; 

the file attribute manager gleaning file attributes concerning each of the plurality 

of scanned files in the plurality of formats; 
the file attribute manager storing gleaned file attributes concerning each of the 

plurality of scanned files as records in a database; and 
the file attribute manager indexing specific file attributes being stored as a record 

in the database concerning a specific file according to contents of that file. 

2. (currently amended) The method of claim 1 wherein: 

the specific gleaned file attributes concerning [[a]] the specific file are a function 
of a protocol according to which the specific file is transmitted. 

3. (currently amended) The method of claim 1 wherein: 

the specific gleaned file attributes concerning [[a]] the specific file are a function 
of the format of that specific file. 

4. (currently amended) The method of claim 1 further comprising: 

the file attribute manager indexing specific file attributes being stored as a record 
in the database concerning a specific file according to a secure hash of the 
contents of that specific file. 

5. (currently amended) The method of claim 1 further comprising: 
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the file attribute manager indexing specific file attributes being stored as a record 
in the database concerning a specific file according to a cyclical redundancy 
check of the contents of that specific file. 

6. (currently amended) The method of claim 1 further comprising: 

the file attribute manager receiving a plurality of copies of the same file; and 
the file attribute manager storing a separate record for each received copy of the 
file, each separate record being indexed according to the contents of the file, 
such that each separate record can be accessed by toe a single index. 

7. (original) The method of claim 1 further comprising: 

deleting records from the database after the records have been stored for a 
specific period of time. 

8. (original) The method of claim 1 wherein the non-application specific file attribute 
manager is incorporated into at least one of the following: 

a firewall; 

an intrusion detection system; 

an intrusion detection system application proxy; 

a router; 

a switch; 

a standalone proxy; 
a server; 
a gateway; 

an anti-virus detection system; 
a client. 

9. (currently amended) A computer readable medium containing a computer 
program product for gleaning file attributes independently of file format, the computer 
program product comprising program code for: 

receiving a plurality of files in a plurality of formats; 
scanning the plurality of received files in the plurality of formats; 
gleaning file attributes concerning each of the plurality of scanned files in the 
plurality of formats; 
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storing gleaned file attributes concerning each of the plurality of scanned files as 

records in a database; and 
indexing file attributes being stored as a record in the database concerning a 

specific file according to contents of that specific file. 

10. (currently amended) The computer program product of claim 9 further 
comprising: 

program code for gleaning specific fHe attributes concerning a specific file as a 
function of a protocol according to which the specific file is transmitted. 

1 1 . (currently amended) The computer program product of claim 9 further 
comprising: 

program code for gleaning specific file attributes concerning a specific file as a 
function of the format of that specific file. 

12. (currently amended) The computer program product of claim 9 further 
comprising: 

program code for indexing fHe attributes being stored as a record in the database 
concerning a specific file according to a secure hash of the contents of that 
specific file. 

13. (currently amended) The computer program product of claim 9 further 
comprising: 

program code for indexing file attributes being stored as a record in the database 
concerning a specific file according to a cyclical redundancy check of the 
contents of that specific file. 

14. (currently amended) The computer program product of claim 9 further 
comprising: 

program code for receiving a plurality of copies of the same file; and 
program code for storing a separate record for each received copy of the file, 
each separate record being indexed according to the contents of the file, such 
that each separate record can be accessed by the a single index. 



1 5. (original) The computer program product of claim 9 further comprising: 
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program code for deleting records from the database after the records have been 
stored for a specific period of time. 

16. (currently amended) A computer system for gleaning file attributes 
independently of file format, the computer system comprising: 

a reception module, configured to receive a plurality of files in a plurality of 
formats; 

a scanning module, configured to scan the plurality of received files in the 
plurality of formats, the scanning module being communicatively coupled to 
the reception module; 

a gleaning module, configured to glean file attributes concerning each of the 
plurality of scanned files in the plurality of formats, the gleaning module being 
communicatively coupled to the scanning module; 

a storage module, configured to store gleaned file attributes concerning each of 
the plurality of scanned files as records in a database, the storage module 
being communicatively coupled to the gleaning module; and 

an indexing module, configured to index file attributes being stored as a record in 
the database concerning a specific file according to contents of that specific 
file, the indexing module being communicatively coupled to the storage 
module. 

17. (currently amended) The computer system of claim 16 wherein: 

the gleaning module is further configured to glean specific file attributes 

concerning a specific file which are a function of a protocol according to which 
the specific file is transmitted. 

18. (currently amended) The computer system of claim 16 wherein: 

the gleaning module is further configured to glean specific file attributes 

concerning a specific file which are a function of the format of that specific file. 

19. (currently amended) The computer system of claim 16 wherein: 

the indexing module is further configured to index file attributes being stored as a 
record in the database concerning a specific file according to a secure hash 
of the contents of that specific file. 
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20. (currently amended) The computer system of claim 16 wherein: 

the indexing module is further configured to index file attributes being stored as a 
record in the database concerning a specific file according to a cyclical 
redundancy check of the contents of that specific file. 

21 . (currently amended) The computer system of claim 16 wherein: 

the reception module is further configured to receive a plurality of copies of the 
same file; and 

the storage module is further configured to store a separate record for each 
received copy of the file, each separate record being indexed according to the 
contents of the file, such that each separate record can be accessed by the a 
single index. 

22. (original) The computer system of claim 16 further comprising: 

a deletion module, configured to delete records from the database after the 
records have been stored for a specific period of time, the deletion module 
being communicatively coupled to the storage module. 

23. (currently amended) The method of claim 1 further comprising: 

examining a file, the file having been processed by the non-application specific 

file attribute manager; 
retrieving at least one stored record concerning the file from the database; 
analyzing gleaned file attributes concerning the file, the gleaned file attributes 

having been retrieved from at least one record concerning the file in the 

database; and 

responsive to analyzing the gleaned file attributes, determining a status 
concerning the file. 

24. (original) The method of claim 23 further comprising: 

responsive to determining the status of the received file to be malicious, blocking 
the file. 

25. (original) The method of claim 23 further comprising: 
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responsive to determining the status of the received file to be legitimate, not 
blocking the file. 



26. (original) The method of claim 23 further comprising: 

applying at least one rule specifying how to use gleaned file attributes to process 
the file. 

27. (original) The method of claim 26 further comprising 

determining at least one of a plurality of rules to apply specifying how to use 
gleaned file attributes to process the file. 
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